Authlib 1.7.1__tar.gz → 1.8.0__tar.gz

{authlib-1.7.1 → authlib-1.8.0}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.7.1
+Version: 1.8.0
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause
@@ -32,8 +32,8 @@ Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: cryptography
-Requires-Dist: joserfc>=1.6.0
+Requires-Dist: cryptography>=45.0.1
+Requires-Dist: joserfc>=1.6.1
 Dynamic: license-file
 
 <div align="center">
@@ -83,33 +83,33 @@ Authlib will deprecate `authlib.jose` module, please read:
 
 Generic, spec-compliant implementation to build clients and providers:
 
-- [The OAuth 1.0 Protocol](https://docs.authlib.org/en/stable/basic/oauth1.html)
-  - [RFC5849: The OAuth 1.0 Protocol](https://docs.authlib.org/en/stable/specs/rfc5849.html)
-- [The OAuth 2.0 Authorization Framework](https://docs.authlib.org/en/stable/basic/oauth2.html)
-  - [RFC6749: The OAuth 2.0 Authorization Framework](https://docs.authlib.org/en/stable/specs/rfc6749.html)
-  - [RFC6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://docs.authlib.org/en/stable/specs/rfc6750.html)
-  - [RFC7009: OAuth 2.0 Token Revocation](https://docs.authlib.org/en/stable/specs/rfc7009.html)
-  - [RFC7523: JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://docs.authlib.org/en/stable/specs/rfc7523.html)
-  - [RFC7591: OAuth 2.0 Dynamic Client Registration Protocol](https://docs.authlib.org/en/stable/specs/rfc7591.html)
-  - [RFC7592: OAuth 2.0 Dynamic Client Registration Management Protocol](https://docs.authlib.org/en/stable/specs/rfc7592.html)
-  - [RFC7636: Proof Key for Code Exchange by OAuth Public Clients](https://docs.authlib.org/en/stable/specs/rfc7636.html)
-  - [RFC7662: OAuth 2.0 Token Introspection](https://docs.authlib.org/en/stable/specs/rfc7662.html)
-  - [RFC8414: OAuth 2.0 Authorization Server Metadata](https://docs.authlib.org/en/stable/specs/rfc8414.html)
-  - [RFC8628: OAuth 2.0 Device Authorization Grant](https://docs.authlib.org/en/stable/specs/rfc8628.html)
-  - [RFC9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://docs.authlib.org/en/stable/specs/rfc9068.html)
-  - [RFC9101: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)](https://docs.authlib.org/en/stable/specs/rfc9101.html)
-  - [RFC9207: OAuth 2.0 Authorization Server Issuer Identification](https://docs.authlib.org/en/stable/specs/rfc9207.html)
+- [The OAuth 1.0 Protocol](https://docs.authlib.org/en/stable/oauth1/index.html)
+  - [RFC5849: The OAuth 1.0 Protocol](https://docs.authlib.org/en/stable/oauth1/specs/rfc5849.html)
+- [The OAuth 2.0 Authorization Framework](https://docs.authlib.org/en/stable/oauth2/index.html)
+  - [RFC6749: The OAuth 2.0 Authorization Framework](https://docs.authlib.org/en/stable/oauth2/specs/rfc6749.html)
+  - [RFC6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://docs.authlib.org/en/stable/oauth2/specs/rfc6750.html)
+  - [RFC7009: OAuth 2.0 Token Revocation](https://docs.authlib.org/en/stable/oauth2/specs/rfc7009.html)
+  - [RFC7523: JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://docs.authlib.org/en/stable/oauth2/specs/rfc7523.html)
+  - [RFC7591: OAuth 2.0 Dynamic Client Registration Protocol](https://docs.authlib.org/en/stable/oauth2/specs/rfc7591.html)
+  - [RFC7592: OAuth 2.0 Dynamic Client Registration Management Protocol](https://docs.authlib.org/en/stable/oauth2/specs/rfc7592.html)
+  - [RFC7636: Proof Key for Code Exchange by OAuth Public Clients](https://docs.authlib.org/en/stable/oauth2/specs/rfc7636.html)
+  - [RFC7662: OAuth 2.0 Token Introspection](https://docs.authlib.org/en/stable/oauth2/specs/rfc7662.html)
+  - [RFC8414: OAuth 2.0 Authorization Server Metadata](https://docs.authlib.org/en/stable/oauth2/specs/rfc8414.html)
+  - [RFC8628: OAuth 2.0 Device Authorization Grant](https://docs.authlib.org/en/stable/oauth2/specs/rfc8628.html)
+  - [RFC9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://docs.authlib.org/en/stable/oauth2/specs/rfc9068.html)
+  - [RFC9101: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)](https://docs.authlib.org/en/stable/oauth2/specs/rfc9101.html)
+  - [RFC9207: OAuth 2.0 Authorization Server Issuer Identification](https://docs.authlib.org/en/stable/oauth2/specs/rfc9207.html)
 - [Javascript Object Signing and Encryption](https://docs.authlib.org/en/stable/jose/index.html)
   - [RFC7515: JSON Web Signature](https://docs.authlib.org/en/stable/jose/jws.html)
   - [RFC7516: JSON Web Encryption](https://docs.authlib.org/en/stable/jose/jwe.html)
   - [RFC7517: JSON Web Key](https://docs.authlib.org/en/stable/jose/jwk.html)
-  - [RFC7518: JSON Web Algorithms](https://docs.authlib.org/en/stable/specs/rfc7518.html)
+  - [RFC7518: JSON Web Algorithms](https://docs.authlib.org/en/stable/jose/specs/rfc7518.html)
   - [RFC7519: JSON Web Token](https://docs.authlib.org/en/stable/jose/jwt.html)
-  - [RFC7638: JSON Web Key (JWK) Thumbprint](https://docs.authlib.org/en/stable/specs/rfc7638.html)
+  - [RFC7638: JSON Web Key (JWK) Thumbprint](https://docs.authlib.org/en/stable/jose/specs/rfc7638.html)
   - [ ] RFC7797: JSON Web Signature (JWS) Unencoded Payload Option
-  - [RFC8037: ECDH in JWS and JWE](https://docs.authlib.org/en/stable/specs/rfc8037.html)
+  - [RFC8037: ECDH in JWS and JWE](https://docs.authlib.org/en/stable/jose/specs/rfc8037.html)
   - [ ] draft-madden-jose-ecdh-1pu-04: Public Key Authenticated Encryption for JOSE: ECDH-1PU
-- [OpenID Connect 1.0](https://docs.authlib.org/en/stable/specs/oidc.html)
+- [OpenID Connect 1.0](https://docs.authlib.org/en/stable/oauth2/specs/oidc.html)
   - [x] OpenID Connect Core 1.0
   - [x] OpenID Connect Discovery 1.0
   - [x] OpenID Connect Dynamic Client Registration 1.0
@@ -118,30 +118,30 @@ Generic, spec-compliant implementation to build clients and providers:
 Connect third party OAuth providers with Authlib built-in client integrations:
 
 - Requests
-  - [OAuth1Session](https://docs.authlib.org/en/stable/client/requests.html#requests-oauth-1-0)
-  - [OAuth2Session](https://docs.authlib.org/en/stable/client/requests.html#requests-oauth-2-0)
-  - [OpenID Connect](https://docs.authlib.org/en/stable/client/requests.html#requests-openid-connect)
-  - [AssertionSession](https://docs.authlib.org/en/stable/client/requests.html#requests-service-account)
+  - [OAuth1Session](https://docs.authlib.org/en/stable/oauth1/client/http/requests.html)
+  - [OAuth2Session](https://docs.authlib.org/en/stable/oauth2/client/http/requests.html#requests-oauth-2-0)
+  - [OpenID Connect](https://docs.authlib.org/en/stable/oauth2/client/http/requests.html#requests-openid-connect)
+  - [AssertionSession](https://docs.authlib.org/en/stable/oauth2/client/http/requests.html#requests-service-account)
 - HTTPX
-  - [AsyncOAuth1Client](https://docs.authlib.org/en/stable/client/httpx.html#httpx-oauth-1-0)
-  - [AsyncOAuth2Client](https://docs.authlib.org/en/stable/client/httpx.html#httpx-oauth-2-0)
-  - [OpenID Connect](https://docs.authlib.org/en/stable/client/httpx.html#httpx-oauth-2-0)
-  - [AsyncAssertionClient](https://docs.authlib.org/en/stable/client/httpx.html#async-service-account)
-- [Flask OAuth Client](https://docs.authlib.org/en/stable/client/flask.html)
-- [Django OAuth Client](https://docs.authlib.org/en/stable/client/django.html)
-- [Starlette OAuth Client](https://docs.authlib.org/en/stable/client/starlette.html)
-- [FastAPI OAuth Client](https://docs.authlib.org/en/stable/client/fastapi.html)
+  - [AsyncOAuth1Client](https://docs.authlib.org/en/stable/oauth1/client/http/httpx.html)
+  - [AsyncOAuth2Client](https://docs.authlib.org/en/stable/oauth2/client/http/httpx.html#httpx-oauth-2-0)
+  - [OpenID Connect](https://docs.authlib.org/en/stable/oauth2/client/http/httpx.html#httpx-oauth-2-0)
+  - [AsyncAssertionClient](https://docs.authlib.org/en/stable/oauth2/client/http/httpx.html#async-service-account)
+- [Flask OAuth Client](https://docs.authlib.org/en/stable/oauth2/client/web/flask.html)
+- [Django OAuth Client](https://docs.authlib.org/en/stable/oauth2/client/web/django.html)
+- [Starlette OAuth Client](https://docs.authlib.org/en/stable/oauth2/client/web/starlette.html)
+- [FastAPI OAuth Client](https://docs.authlib.org/en/stable/oauth2/client/web/fastapi.html)
 
 Build your own OAuth 1.0, OAuth 2.0, and OpenID Connect providers:
 
 - Flask
-  - [Flask OAuth 1.0 Provider](https://docs.authlib.org/en/stable/flask/1/)
-  - [Flask OAuth 2.0 Provider](https://docs.authlib.org/en/stable/flask/2/)
-  - [Flask OpenID Connect 1.0 Provider](https://docs.authlib.org/en/stable/flask/2/openid-connect.html)
+  - [Flask OAuth 1.0 Provider](https://docs.authlib.org/en/stable/oauth1/provider/flask/index.html)
+  - [Flask OAuth 2.0 Provider](https://docs.authlib.org/en/stable/oauth2/authorization-server/flask/index.html)
+  - [Flask OpenID Connect 1.0 Provider](https://docs.authlib.org/en/stable/oauth2/authorization-server/flask/openid-connect.html)
 - Django
-  - [Django OAuth 1.0 Provider](https://docs.authlib.org/en/stable/django/1/)
-  - [Django OAuth 2.0 Provider](https://docs.authlib.org/en/stable/django/2/)
-  - [Django OpenID Connect 1.0 Provider](https://docs.authlib.org/en/stable/django/2/openid-connect.html)
+  - [Django OAuth 1.0 Provider](https://docs.authlib.org/en/stable/oauth1/provider/django/index.html)
+  - [Django OAuth 2.0 Provider](https://docs.authlib.org/en/stable/oauth2/authorization-server/django/index.html)
+  - [Django OpenID Connect 1.0 Provider](https://docs.authlib.org/en/stable/oauth2/authorization-server/django/openid-connect.html)
 
 ## Useful Links
 

{authlib-1.7.1 → authlib-1.8.0}/Authlib.egg-info/SOURCES.txt

@@ -15,6 +15,7 @@ authlib/deprecate.py
 authlib/common/__init__.py
 authlib/common/encoding.py
 authlib/common/errors.py
+authlib/common/language.py
 authlib/common/security.py
 authlib/common/urls.py
 authlib/integrations/__init__.py
@@ -53,6 +54,7 @@ authlib/integrations/flask_oauth2/requests.py
 authlib/integrations/flask_oauth2/resource_protector.py
 authlib/integrations/flask_oauth2/signals.py
 authlib/integrations/httpx_client/__init__.py
+authlib/integrations/httpx_client/_compat.py
 authlib/integrations/httpx_client/assertion_client.py
 authlib/integrations/httpx_client/oauth1_client.py
 authlib/integrations/httpx_client/oauth2_client.py

authlib-1.8.0/Authlib.egg-info/requires.txt

@@ -0,0 +1,2 @@
+cryptography>=45.0.1
+joserfc>=1.6.1

{authlib-1.7.1 → authlib-1.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.7.1
+Version: 1.8.0
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause
@@ -32,8 +32,8 @@ Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: cryptography
-Requires-Dist: joserfc>=1.6.0
+Requires-Dist: cryptography>=45.0.1
+Requires-Dist: joserfc>=1.6.1
 Dynamic: license-file
 
 <div align="center">
@@ -83,33 +83,33 @@ Authlib will deprecate `authlib.jose` module, please read:
 
 Generic, spec-compliant implementation to build clients and providers:
 
-- [The OAuth 1.0 Protocol](https://docs.authlib.org/en/stable/basic/oauth1.html)
-  - [RFC5849: The OAuth 1.0 Protocol](https://docs.authlib.org/en/stable/specs/rfc5849.html)
-- [The OAuth 2.0 Authorization Framework](https://docs.authlib.org/en/stable/basic/oauth2.html)
-  - [RFC6749: The OAuth 2.0 Authorization Framework](https://docs.authlib.org/en/stable/specs/rfc6749.html)
-  - [RFC6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://docs.authlib.org/en/stable/specs/rfc6750.html)
-  - [RFC7009: OAuth 2.0 Token Revocation](https://docs.authlib.org/en/stable/specs/rfc7009.html)
-  - [RFC7523: JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://docs.authlib.org/en/stable/specs/rfc7523.html)
-  - [RFC7591: OAuth 2.0 Dynamic Client Registration Protocol](https://docs.authlib.org/en/stable/specs/rfc7591.html)
-  - [RFC7592: OAuth 2.0 Dynamic Client Registration Management Protocol](https://docs.authlib.org/en/stable/specs/rfc7592.html)
-  - [RFC7636: Proof Key for Code Exchange by OAuth Public Clients](https://docs.authlib.org/en/stable/specs/rfc7636.html)
-  - [RFC7662: OAuth 2.0 Token Introspection](https://docs.authlib.org/en/stable/specs/rfc7662.html)
-  - [RFC8414: OAuth 2.0 Authorization Server Metadata](https://docs.authlib.org/en/stable/specs/rfc8414.html)
-  - [RFC8628: OAuth 2.0 Device Authorization Grant](https://docs.authlib.org/en/stable/specs/rfc8628.html)
-  - [RFC9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://docs.authlib.org/en/stable/specs/rfc9068.html)
-  - [RFC9101: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)](https://docs.authlib.org/en/stable/specs/rfc9101.html)
-  - [RFC9207: OAuth 2.0 Authorization Server Issuer Identification](https://docs.authlib.org/en/stable/specs/rfc9207.html)
+- [The OAuth 1.0 Protocol](https://docs.authlib.org/en/stable/oauth1/index.html)
+  - [RFC5849: The OAuth 1.0 Protocol](https://docs.authlib.org/en/stable/oauth1/specs/rfc5849.html)
+- [The OAuth 2.0 Authorization Framework](https://docs.authlib.org/en/stable/oauth2/index.html)
+  - [RFC6749: The OAuth 2.0 Authorization Framework](https://docs.authlib.org/en/stable/oauth2/specs/rfc6749.html)
+  - [RFC6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://docs.authlib.org/en/stable/oauth2/specs/rfc6750.html)
+  - [RFC7009: OAuth 2.0 Token Revocation](https://docs.authlib.org/en/stable/oauth2/specs/rfc7009.html)
+  - [RFC7523: JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://docs.authlib.org/en/stable/oauth2/specs/rfc7523.html)
+  - [RFC7591: OAuth 2.0 Dynamic Client Registration Protocol](https://docs.authlib.org/en/stable/oauth2/specs/rfc7591.html)
+  - [RFC7592: OAuth 2.0 Dynamic Client Registration Management Protocol](https://docs.authlib.org/en/stable/oauth2/specs/rfc7592.html)
+  - [RFC7636: Proof Key for Code Exchange by OAuth Public Clients](https://docs.authlib.org/en/stable/oauth2/specs/rfc7636.html)
+  - [RFC7662: OAuth 2.0 Token Introspection](https://docs.authlib.org/en/stable/oauth2/specs/rfc7662.html)
+  - [RFC8414: OAuth 2.0 Authorization Server Metadata](https://docs.authlib.org/en/stable/oauth2/specs/rfc8414.html)
+  - [RFC8628: OAuth 2.0 Device Authorization Grant](https://docs.authlib.org/en/stable/oauth2/specs/rfc8628.html)
+  - [RFC9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://docs.authlib.org/en/stable/oauth2/specs/rfc9068.html)
+  - [RFC9101: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)](https://docs.authlib.org/en/stable/oauth2/specs/rfc9101.html)
+  - [RFC9207: OAuth 2.0 Authorization Server Issuer Identification](https://docs.authlib.org/en/stable/oauth2/specs/rfc9207.html)
 - [Javascript Object Signing and Encryption](https://docs.authlib.org/en/stable/jose/index.html)
   - [RFC7515: JSON Web Signature](https://docs.authlib.org/en/stable/jose/jws.html)
   - [RFC7516: JSON Web Encryption](https://docs.authlib.org/en/stable/jose/jwe.html)
   - [RFC7517: JSON Web Key](https://docs.authlib.org/en/stable/jose/jwk.html)
-  - [RFC7518: JSON Web Algorithms](https://docs.authlib.org/en/stable/specs/rfc7518.html)
+  - [RFC7518: JSON Web Algorithms](https://docs.authlib.org/en/stable/jose/specs/rfc7518.html)
   - [RFC7519: JSON Web Token](https://docs.authlib.org/en/stable/jose/jwt.html)
-  - [RFC7638: JSON Web Key (JWK) Thumbprint](https://docs.authlib.org/en/stable/specs/rfc7638.html)
+  - [RFC7638: JSON Web Key (JWK) Thumbprint](https://docs.authlib.org/en/stable/jose/specs/rfc7638.html)
   - [ ] RFC7797: JSON Web Signature (JWS) Unencoded Payload Option
-  - [RFC8037: ECDH in JWS and JWE](https://docs.authlib.org/en/stable/specs/rfc8037.html)
+  - [RFC8037: ECDH in JWS and JWE](https://docs.authlib.org/en/stable/jose/specs/rfc8037.html)
   - [ ] draft-madden-jose-ecdh-1pu-04: Public Key Authenticated Encryption for JOSE: ECDH-1PU
-- [OpenID Connect 1.0](https://docs.authlib.org/en/stable/specs/oidc.html)
+- [OpenID Connect 1.0](https://docs.authlib.org/en/stable/oauth2/specs/oidc.html)
   - [x] OpenID Connect Core 1.0
   - [x] OpenID Connect Discovery 1.0
   - [x] OpenID Connect Dynamic Client Registration 1.0
@@ -118,30 +118,30 @@ Generic, spec-compliant implementation to build clients and providers:
 Connect third party OAuth providers with Authlib built-in client integrations:
 
 - Requests
-  - [OAuth1Session](https://docs.authlib.org/en/stable/client/requests.html#requests-oauth-1-0)
-  - [OAuth2Session](https://docs.authlib.org/en/stable/client/requests.html#requests-oauth-2-0)
-  - [OpenID Connect](https://docs.authlib.org/en/stable/client/requests.html#requests-openid-connect)
-  - [AssertionSession](https://docs.authlib.org/en/stable/client/requests.html#requests-service-account)
+  - [OAuth1Session](https://docs.authlib.org/en/stable/oauth1/client/http/requests.html)
+  - [OAuth2Session](https://docs.authlib.org/en/stable/oauth2/client/http/requests.html#requests-oauth-2-0)
+  - [OpenID Connect](https://docs.authlib.org/en/stable/oauth2/client/http/requests.html#requests-openid-connect)
+  - [AssertionSession](https://docs.authlib.org/en/stable/oauth2/client/http/requests.html#requests-service-account)
 - HTTPX
-  - [AsyncOAuth1Client](https://docs.authlib.org/en/stable/client/httpx.html#httpx-oauth-1-0)
-  - [AsyncOAuth2Client](https://docs.authlib.org/en/stable/client/httpx.html#httpx-oauth-2-0)
-  - [OpenID Connect](https://docs.authlib.org/en/stable/client/httpx.html#httpx-oauth-2-0)
-  - [AsyncAssertionClient](https://docs.authlib.org/en/stable/client/httpx.html#async-service-account)
-- [Flask OAuth Client](https://docs.authlib.org/en/stable/client/flask.html)
-- [Django OAuth Client](https://docs.authlib.org/en/stable/client/django.html)
-- [Starlette OAuth Client](https://docs.authlib.org/en/stable/client/starlette.html)
-- [FastAPI OAuth Client](https://docs.authlib.org/en/stable/client/fastapi.html)
+  - [AsyncOAuth1Client](https://docs.authlib.org/en/stable/oauth1/client/http/httpx.html)
+  - [AsyncOAuth2Client](https://docs.authlib.org/en/stable/oauth2/client/http/httpx.html#httpx-oauth-2-0)
+  - [OpenID Connect](https://docs.authlib.org/en/stable/oauth2/client/http/httpx.html#httpx-oauth-2-0)
+  - [AsyncAssertionClient](https://docs.authlib.org/en/stable/oauth2/client/http/httpx.html#async-service-account)
+- [Flask OAuth Client](https://docs.authlib.org/en/stable/oauth2/client/web/flask.html)
+- [Django OAuth Client](https://docs.authlib.org/en/stable/oauth2/client/web/django.html)
+- [Starlette OAuth Client](https://docs.authlib.org/en/stable/oauth2/client/web/starlette.html)
+- [FastAPI OAuth Client](https://docs.authlib.org/en/stable/oauth2/client/web/fastapi.html)
 
 Build your own OAuth 1.0, OAuth 2.0, and OpenID Connect providers:
 
 - Flask
-  - [Flask OAuth 1.0 Provider](https://docs.authlib.org/en/stable/flask/1/)
-  - [Flask OAuth 2.0 Provider](https://docs.authlib.org/en/stable/flask/2/)
-  - [Flask OpenID Connect 1.0 Provider](https://docs.authlib.org/en/stable/flask/2/openid-connect.html)
+  - [Flask OAuth 1.0 Provider](https://docs.authlib.org/en/stable/oauth1/provider/flask/index.html)
+  - [Flask OAuth 2.0 Provider](https://docs.authlib.org/en/stable/oauth2/authorization-server/flask/index.html)
+  - [Flask OpenID Connect 1.0 Provider](https://docs.authlib.org/en/stable/oauth2/authorization-server/flask/openid-connect.html)
 - Django
-  - [Django OAuth 1.0 Provider](https://docs.authlib.org/en/stable/django/1/)
-  - [Django OAuth 2.0 Provider](https://docs.authlib.org/en/stable/django/2/)
-  - [Django OpenID Connect 1.0 Provider](https://docs.authlib.org/en/stable/django/2/openid-connect.html)
+  - [Django OAuth 1.0 Provider](https://docs.authlib.org/en/stable/oauth1/provider/django/index.html)
+  - [Django OAuth 2.0 Provider](https://docs.authlib.org/en/stable/oauth2/authorization-server/django/index.html)
+  - [Django OpenID Connect 1.0 Provider](https://docs.authlib.org/en/stable/oauth2/authorization-server/django/openid-connect.html)
 
 ## Useful Links
 

{authlib-1.7.1 → authlib-1.8.0}/README.md

@@ -45,33 +45,33 @@ Authlib will deprecate `authlib.jose` module, please read:
 
 Generic, spec-compliant implementation to build clients and providers:
 
-- [The OAuth 1.0 Protocol](https://docs.authlib.org/en/stable/basic/oauth1.html)
-  - [RFC5849: The OAuth 1.0 Protocol](https://docs.authlib.org/en/stable/specs/rfc5849.html)
-- [The OAuth 2.0 Authorization Framework](https://docs.authlib.org/en/stable/basic/oauth2.html)
-  - [RFC6749: The OAuth 2.0 Authorization Framework](https://docs.authlib.org/en/stable/specs/rfc6749.html)
-  - [RFC6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://docs.authlib.org/en/stable/specs/rfc6750.html)
-  - [RFC7009: OAuth 2.0 Token Revocation](https://docs.authlib.org/en/stable/specs/rfc7009.html)
-  - [RFC7523: JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://docs.authlib.org/en/stable/specs/rfc7523.html)
-  - [RFC7591: OAuth 2.0 Dynamic Client Registration Protocol](https://docs.authlib.org/en/stable/specs/rfc7591.html)
-  - [RFC7592: OAuth 2.0 Dynamic Client Registration Management Protocol](https://docs.authlib.org/en/stable/specs/rfc7592.html)
-  - [RFC7636: Proof Key for Code Exchange by OAuth Public Clients](https://docs.authlib.org/en/stable/specs/rfc7636.html)
-  - [RFC7662: OAuth 2.0 Token Introspection](https://docs.authlib.org/en/stable/specs/rfc7662.html)
-  - [RFC8414: OAuth 2.0 Authorization Server Metadata](https://docs.authlib.org/en/stable/specs/rfc8414.html)
-  - [RFC8628: OAuth 2.0 Device Authorization Grant](https://docs.authlib.org/en/stable/specs/rfc8628.html)
-  - [RFC9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://docs.authlib.org/en/stable/specs/rfc9068.html)
-  - [RFC9101: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)](https://docs.authlib.org/en/stable/specs/rfc9101.html)
-  - [RFC9207: OAuth 2.0 Authorization Server Issuer Identification](https://docs.authlib.org/en/stable/specs/rfc9207.html)
+- [The OAuth 1.0 Protocol](https://docs.authlib.org/en/stable/oauth1/index.html)
+  - [RFC5849: The OAuth 1.0 Protocol](https://docs.authlib.org/en/stable/oauth1/specs/rfc5849.html)
+- [The OAuth 2.0 Authorization Framework](https://docs.authlib.org/en/stable/oauth2/index.html)
+  - [RFC6749: The OAuth 2.0 Authorization Framework](https://docs.authlib.org/en/stable/oauth2/specs/rfc6749.html)
+  - [RFC6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://docs.authlib.org/en/stable/oauth2/specs/rfc6750.html)
+  - [RFC7009: OAuth 2.0 Token Revocation](https://docs.authlib.org/en/stable/oauth2/specs/rfc7009.html)
+  - [RFC7523: JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://docs.authlib.org/en/stable/oauth2/specs/rfc7523.html)
+  - [RFC7591: OAuth 2.0 Dynamic Client Registration Protocol](https://docs.authlib.org/en/stable/oauth2/specs/rfc7591.html)
+  - [RFC7592: OAuth 2.0 Dynamic Client Registration Management Protocol](https://docs.authlib.org/en/stable/oauth2/specs/rfc7592.html)
+  - [RFC7636: Proof Key for Code Exchange by OAuth Public Clients](https://docs.authlib.org/en/stable/oauth2/specs/rfc7636.html)
+  - [RFC7662: OAuth 2.0 Token Introspection](https://docs.authlib.org/en/stable/oauth2/specs/rfc7662.html)
+  - [RFC8414: OAuth 2.0 Authorization Server Metadata](https://docs.authlib.org/en/stable/oauth2/specs/rfc8414.html)
+  - [RFC8628: OAuth 2.0 Device Authorization Grant](https://docs.authlib.org/en/stable/oauth2/specs/rfc8628.html)
+  - [RFC9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://docs.authlib.org/en/stable/oauth2/specs/rfc9068.html)
+  - [RFC9101: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)](https://docs.authlib.org/en/stable/oauth2/specs/rfc9101.html)
+  - [RFC9207: OAuth 2.0 Authorization Server Issuer Identification](https://docs.authlib.org/en/stable/oauth2/specs/rfc9207.html)
 - [Javascript Object Signing and Encryption](https://docs.authlib.org/en/stable/jose/index.html)
   - [RFC7515: JSON Web Signature](https://docs.authlib.org/en/stable/jose/jws.html)
   - [RFC7516: JSON Web Encryption](https://docs.authlib.org/en/stable/jose/jwe.html)
   - [RFC7517: JSON Web Key](https://docs.authlib.org/en/stable/jose/jwk.html)
-  - [RFC7518: JSON Web Algorithms](https://docs.authlib.org/en/stable/specs/rfc7518.html)
+  - [RFC7518: JSON Web Algorithms](https://docs.authlib.org/en/stable/jose/specs/rfc7518.html)
   - [RFC7519: JSON Web Token](https://docs.authlib.org/en/stable/jose/jwt.html)
-  - [RFC7638: JSON Web Key (JWK) Thumbprint](https://docs.authlib.org/en/stable/specs/rfc7638.html)
+  - [RFC7638: JSON Web Key (JWK) Thumbprint](https://docs.authlib.org/en/stable/jose/specs/rfc7638.html)
   - [ ] RFC7797: JSON Web Signature (JWS) Unencoded Payload Option
-  - [RFC8037: ECDH in JWS and JWE](https://docs.authlib.org/en/stable/specs/rfc8037.html)
+  - [RFC8037: ECDH in JWS and JWE](https://docs.authlib.org/en/stable/jose/specs/rfc8037.html)
   - [ ] draft-madden-jose-ecdh-1pu-04: Public Key Authenticated Encryption for JOSE: ECDH-1PU
-- [OpenID Connect 1.0](https://docs.authlib.org/en/stable/specs/oidc.html)
+- [OpenID Connect 1.0](https://docs.authlib.org/en/stable/oauth2/specs/oidc.html)
   - [x] OpenID Connect Core 1.0
   - [x] OpenID Connect Discovery 1.0
   - [x] OpenID Connect Dynamic Client Registration 1.0
@@ -80,30 +80,30 @@ Generic, spec-compliant implementation to build clients and providers:
 Connect third party OAuth providers with Authlib built-in client integrations:
 
 - Requests
-  - [OAuth1Session](https://docs.authlib.org/en/stable/client/requests.html#requests-oauth-1-0)
-  - [OAuth2Session](https://docs.authlib.org/en/stable/client/requests.html#requests-oauth-2-0)
-  - [OpenID Connect](https://docs.authlib.org/en/stable/client/requests.html#requests-openid-connect)
-  - [AssertionSession](https://docs.authlib.org/en/stable/client/requests.html#requests-service-account)
+  - [OAuth1Session](https://docs.authlib.org/en/stable/oauth1/client/http/requests.html)
+  - [OAuth2Session](https://docs.authlib.org/en/stable/oauth2/client/http/requests.html#requests-oauth-2-0)
+  - [OpenID Connect](https://docs.authlib.org/en/stable/oauth2/client/http/requests.html#requests-openid-connect)
+  - [AssertionSession](https://docs.authlib.org/en/stable/oauth2/client/http/requests.html#requests-service-account)
 - HTTPX
-  - [AsyncOAuth1Client](https://docs.authlib.org/en/stable/client/httpx.html#httpx-oauth-1-0)
-  - [AsyncOAuth2Client](https://docs.authlib.org/en/stable/client/httpx.html#httpx-oauth-2-0)
-  - [OpenID Connect](https://docs.authlib.org/en/stable/client/httpx.html#httpx-oauth-2-0)
-  - [AsyncAssertionClient](https://docs.authlib.org/en/stable/client/httpx.html#async-service-account)
-- [Flask OAuth Client](https://docs.authlib.org/en/stable/client/flask.html)
-- [Django OAuth Client](https://docs.authlib.org/en/stable/client/django.html)
-- [Starlette OAuth Client](https://docs.authlib.org/en/stable/client/starlette.html)
-- [FastAPI OAuth Client](https://docs.authlib.org/en/stable/client/fastapi.html)
+  - [AsyncOAuth1Client](https://docs.authlib.org/en/stable/oauth1/client/http/httpx.html)
+  - [AsyncOAuth2Client](https://docs.authlib.org/en/stable/oauth2/client/http/httpx.html#httpx-oauth-2-0)
+  - [OpenID Connect](https://docs.authlib.org/en/stable/oauth2/client/http/httpx.html#httpx-oauth-2-0)
+  - [AsyncAssertionClient](https://docs.authlib.org/en/stable/oauth2/client/http/httpx.html#async-service-account)
+- [Flask OAuth Client](https://docs.authlib.org/en/stable/oauth2/client/web/flask.html)
+- [Django OAuth Client](https://docs.authlib.org/en/stable/oauth2/client/web/django.html)
+- [Starlette OAuth Client](https://docs.authlib.org/en/stable/oauth2/client/web/starlette.html)
+- [FastAPI OAuth Client](https://docs.authlib.org/en/stable/oauth2/client/web/fastapi.html)
 
 Build your own OAuth 1.0, OAuth 2.0, and OpenID Connect providers:
 
 - Flask
-  - [Flask OAuth 1.0 Provider](https://docs.authlib.org/en/stable/flask/1/)
-  - [Flask OAuth 2.0 Provider](https://docs.authlib.org/en/stable/flask/2/)
-  - [Flask OpenID Connect 1.0 Provider](https://docs.authlib.org/en/stable/flask/2/openid-connect.html)
+  - [Flask OAuth 1.0 Provider](https://docs.authlib.org/en/stable/oauth1/provider/flask/index.html)
+  - [Flask OAuth 2.0 Provider](https://docs.authlib.org/en/stable/oauth2/authorization-server/flask/index.html)
+  - [Flask OpenID Connect 1.0 Provider](https://docs.authlib.org/en/stable/oauth2/authorization-server/flask/openid-connect.html)
 - Django
-  - [Django OAuth 1.0 Provider](https://docs.authlib.org/en/stable/django/1/)
-  - [Django OAuth 2.0 Provider](https://docs.authlib.org/en/stable/django/2/)
-  - [Django OpenID Connect 1.0 Provider](https://docs.authlib.org/en/stable/django/2/openid-connect.html)
+  - [Django OAuth 1.0 Provider](https://docs.authlib.org/en/stable/oauth1/provider/django/index.html)
+  - [Django OAuth 2.0 Provider](https://docs.authlib.org/en/stable/oauth2/authorization-server/django/index.html)
+  - [Django OpenID Connect 1.0 Provider](https://docs.authlib.org/en/stable/oauth2/authorization-server/django/openid-connect.html)
 
 ## Useful Links
 

authlib-1.8.0/authlib/common/language.py

@@ -0,0 +1,13 @@
+import re
+
+# Structurally validates BCP 47 language tags (RFC 5646).
+# Accepts private-use tags (x-...) and standard tags (2-8 alpha + optional subtags).
+# Does not validate subtags against the IANA registry.
+_LANGUAGE_TAG_RE = re.compile(
+    r"^(x(-[a-zA-Z0-9]{1,8})+|[a-zA-Z]{2,8}(-[a-zA-Z0-9]{1,8})*)$"
+)
+
+
+def is_valid_language_tag(tag):
+    """Return True if tag is a structurally valid BCP 47 language tag."""
+    return isinstance(tag, str) and bool(_LANGUAGE_TAG_RE.match(tag))

authlib-1.8.0/authlib/common/security.py

@@ -0,0 +1,48 @@
+import ipaddress
+import os
+import random
+import string
+from urllib.parse import urlsplit
+
+UNICODE_ASCII_CHARACTER_SET = string.ascii_letters + string.digits
+
+
+def generate_token(length=30, chars=UNICODE_ASCII_CHARACTER_SET):
+    rand = random.SystemRandom()
+    return "".join(rand.choice(chars) for _ in range(length))
+
+
+def is_secure_transport(uri):
+    """Check if the uri is over ssl."""
+    if os.getenv("AUTHLIB_INSECURE_TRANSPORT"):
+        return True
+
+    try:
+        parts = urlsplit(uri)
+    except ValueError:
+        return False
+
+    if not parts.hostname:
+        return False
+
+    if parts.scheme == "https":
+        return True
+
+    if parts.scheme != "http":
+        return False
+
+    # rfc8252 §7.3: native apps may use http for loopback redirection URIs.
+    if parts.hostname == "localhost":
+        return True
+
+    try:
+        address = ipaddress.ip_address(parts.hostname)
+    except ValueError:
+        return False
+
+    # IPv6Address.is_loopback only accounts for the mapped IPv4 address since
+    # CPython 3.10.16, 3.11.11 and 3.12.4.
+    if isinstance(address, ipaddress.IPv6Address) and address.ipv4_mapped:
+        address = address.ipv4_mapped
+
+    return address.is_loopback

{authlib-1.7.1 → authlib-1.8.0}/authlib/common/urls.py

@@ -140,7 +140,16 @@ def extract_params(raw):
 
 
 def is_valid_url(url: str, fragments_allowed=True):
-    parsed = urlparse.urlparse(url)
-    return (
+    try:
+        parsed = urlparse.urlparse(url)
+    except ValueError:
+        return False
+
+    # The userinfo component can disguise the actual host,
+    # as in "https://provider.test@attacker.test/".
+    if "@" in parsed.netloc:
+        return False
+
+    return bool(
         parsed.scheme and parsed.hostname and (fragments_allowed or not parsed.fragment)
     )

{authlib-1.7.1 → authlib-1.8.0}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.7.1"
+version = "1.8.0"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.7.1 → authlib-1.8.0}/authlib/integrations/base_client/async_openid.py

@@ -1,6 +1,7 @@
 from joserfc import jwt
 from joserfc.errors import InvalidKeyIdError
 from joserfc.jwk import KeySet
+from joserfc.jws import JWSRegistry
 
 from authlib.common.security import generate_token
 from authlib.common.urls import add_params_to_uri
@@ -67,7 +68,7 @@ class AsyncOpenIDMixin:
             token = jwt.decode(
                 token["id_token"],
                 key=key_set,
-                algorithms=alg_values,
+                registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
             )
         except InvalidKeyIdError:
             jwks = await self.fetch_jwk_set(force=True)
@@ -75,7 +76,7 @@ class AsyncOpenIDMixin:
             token = jwt.decode(
                 token["id_token"],
                 key=key_set,
-                algorithms=alg_values,
+                registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
             )
 
         claims = claims_cls(token.claims, token.header, claims_options, claims_params)

{authlib-1.7.1 → authlib-1.8.0}/authlib/integrations/base_client/sync_openid.py

@@ -1,6 +1,7 @@
 from joserfc import jwt
 from joserfc.errors import InvalidKeyIdError
 from joserfc.jwk import KeySet
+from joserfc.jws import JWSRegistry
 
 from authlib.common.security import generate_token
 from authlib.common.urls import add_params_to_uri
@@ -66,14 +67,14 @@ class OpenIDMixin:
             token = jwt.decode(
                 token["id_token"],
                 key=key_set,
-                algorithms=alg_values,
+                registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
             )
         except InvalidKeyIdError:
             key_set = KeySet.import_key_set(self.fetch_jwk_set(force=True))
             token = jwt.decode(
                 token["id_token"],
                 key=key_set,
-                algorithms=alg_values,
+                registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
             )
 
         claims = claims_cls(token.claims, token.header, claims_options, claims_params)

authlib-1.8.0/authlib/integrations/httpx_client/_compat.py

@@ -0,0 +1,18 @@
+"""Compatibility shim for httpx2 with legacy httpx fallback.
+
+Falls back to httpx when httpx2 is unavailable. The fallback is deprecated
+and will be removed in a future release.
+"""
+
+from authlib.deprecate import deprecate
+
+try:
+    import httpx2
+except ImportError:
+    import httpx as httpx2
+
+    deprecate(
+        "The httpx module is deprecated; please use httpx2 instead."
+    )
+
+__all__ = ["httpx2"]

{authlib-1.7.1 → authlib-1.8.0}/authlib/integrations/httpx_client/assertion_client.py

@@ -1,18 +1,18 @@
-import httpx
-from httpx import USE_CLIENT_DEFAULT
-from httpx import Response
-
 from authlib.oauth2.rfc7521 import AssertionClient as _AssertionClient
 from authlib.oauth2.rfc7523 import JWTBearerGrant
 
 from ..base_client import OAuthError
+from ._compat import httpx2
 from .oauth2_client import OAuth2Auth
 from .utils import extract_client_kwargs
 
+USE_CLIENT_DEFAULT = httpx2.USE_CLIENT_DEFAULT
+Response = httpx2.Response
+
 __all__ = ["AsyncAssertionClient"]
 
 
-class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient):
+class AsyncAssertionClient(_AssertionClient, httpx2.AsyncClient):
     token_auth_class = OAuth2Auth
     oauth_error_class = OAuthError
     JWT_BEARER_GRANT_TYPE = JWTBearerGrant.GRANT_TYPE
@@ -31,10 +31,11 @@ class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient):
         claims=None,
         token_placement="header",
         scope=None,
+        client_id=None,
         **kwargs,
     ):
         client_kwargs = extract_client_kwargs(kwargs)
-        httpx.AsyncClient.__init__(self, **client_kwargs)
+        httpx2.AsyncClient.__init__(self, **client_kwargs)
 
         _AssertionClient.__init__(
             self,
@@ -47,6 +48,7 @@ class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient):
             claims=claims,
             token_placement=token_placement,
             scope=scope,
+            client_id=client_id,
             **kwargs,
         )
 
@@ -69,7 +71,7 @@ class AsyncAssertionClient(_AssertionClient, httpx.AsyncClient):
         return self.parse_response_token(resp)
 
 
-class AssertionClient(_AssertionClient, httpx.Client):
+class AssertionClient(_AssertionClient, httpx2.Client):
     token_auth_class = OAuth2Auth
     oauth_error_class = OAuthError
     JWT_BEARER_GRANT_TYPE = JWTBearerGrant.GRANT_TYPE
@@ -88,15 +90,11 @@ class AssertionClient(_AssertionClient, httpx.Client):
         claims=None,
         token_placement="header",
         scope=None,
+        client_id=None,
         **kwargs,
     ):
         client_kwargs = extract_client_kwargs(kwargs)
-        # app keyword was dropped!
-        app_value = client_kwargs.pop("app", None)
-        if app_value is not None:
-            client_kwargs["transport"] = httpx.WSGITransport(app=app_value)
-
-        httpx.Client.__init__(self, **client_kwargs)
+        httpx2.Client.__init__(self, **client_kwargs)
 
         _AssertionClient.__init__(
             self,
@@ -109,6 +107,7 @@ class AssertionClient(_AssertionClient, httpx.Client):
             claims=claims,
             token_placement=token_placement,
             scope=scope,
+            client_id=client_id,
             **kwargs,
         )